PIPL Art. 39 separate consent: For users in mainland China, this Inventory together with §6 of the Privacy Policy constitutes the disclosure and separate consent required by PIPL Art. 39 for the cross-border transfer of your personal information. Accepting the Privacy Policy constitutes separate consent for the transfers listed below. You may withdraw consent by deleting your account or disabling the corresponding feature.
1. Overall posture
Our primary servers, user database, and object storage are located in mainland China (Alibaba Cloud East-1 Hangzhou / East-2 Shanghai). The vast majority of personal information is stored and processed entirely within mainland China. The transfers below are the minimum necessary to operate Apple, Google, Spotify, and Sentry functionality.
Functional Software (Sentry): SOC 2 Type II, ISO/IEC 27001; data-residency selectable — sentry.io/privacy
5. Safeguards
All cross-border transfers via TLS 1.2+
Minimum necessary information (push tokens do not contain user identity; notification text is service-generated)
No cross-border sharing of user profiles; no cross-border advertising attribution
6. PIPL threshold check
Per the Cyberspace Administration of China's Standard Contract Measures and Data Outbound Security Assessment Measures:
We are not a Critical Information Infrastructure Operator
As of the last-updated date, our cumulative cross-border PI export has not reached 1,000,000 individuals, nor 10,000 individuals' sensitive PI, nor the 100,000-individual annual threshold for mandatory security assessment
We therefore rely on separate consent + contract necessity. When thresholds are met, we will conduct a Personal Information Protection Impact Assessment and submit either a security-assessment or standard-contract filing as required
7. Withdrawing consent
Delete account in-app: withdraws all consents
Disable notifications in OS Settings: withdraws #1, #2
Disconnect Apple Music / Spotify: withdraws #3, #4, #5
Switch to a different sign-in method: withdraws #7
Withdrawal does not affect processing already performed under prior consent.
8. For EU/UK users (GDPR Chapter V)
Our primary servers are located in mainland China. Transfers to recipients outside the EEA / UK rely on the following safeguards under GDPR Chapter V: contractual safeguards with the recipient where available; explicit consent under Art. 49(1)(a); transfer necessary for performance of the contract under Art. 49(1)(b). You may request additional information about the safeguards via privacy@bwv988.com.